Iptables and 3CX security

[Eloy]

Hi there,

I just recently started using 3CX, I have it installed on a Debian 9 cloud server. So far, I've been getting a lot of messages about blacklisted IPs. After changing the default port (5001) things got quite better, I started using the integrated console restrictions as well, but still I get blacklisted IP messages all the time. My question here is:

Is this normal? Can I improve my security somehow? Because I've changed the default policy of iptables to "DROP" and only allowed certain IPs to reach the admin console, but the list is getting quite huge and things start to get slow. What would you say are your "must haves" on fresh 3cx installations when it comes to security? Here are my current rules:

Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    ACCEPT     udp  --  anywhere             224.0.1.75
2    ACCEPT     tcp  --  anywhere             anywhere             multiport dports 5000... tcp flags:FIN,SYN,RST,ACK/SYN ctstate NEW
3    ACCEPT     udp  --  anywhere             anywhere             multiport dports ...
4    ACCEPT     udp  --  anywhere             224.0.1.75
5    ACCEPT     tcp  --  anywhere             anywhere             multiport dports 5000... tcp flags:FIN,SYN,RST,ACK/SYN ctstate NEW
6    ACCEPT     udp  --  anywhere             anywhere             multiport dports ...
7    ACCEPT     tcp  --  my ip                anywhere             state NEW,RELATED,ESTABLISHED tcp dpt:sshport
8    ACCEPT     tcp  --  my ip                anywhere             tcp dpt:custom console port

Chain FORWARD (policy DROP)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

I only leave the 5000 as default, then the ... on the default rules represent the custom ports I use.

Thank you in advance.

Regards

 

[Alphabetic]

3CX shouldnt be the first line of defence.

I would look getting a parameter firewall and restricting traffic based on IP of your offices.

in some cases it's not possible due to dynamic IPs. However, if security is that much of a concern to you, you would lock it down and use SBCs.

It doesnt matter what you change the port to, there are millions of bots on the internet whose sole purpose is to scan the internet for open ports and to brute force.

 

[SteveITS]

We allow connections to the various 3CX ports only from US IPs and our SIP provider/partner. We also set Security/Security Settings/Console Restrictions to "Allow Access from specific IP Addresses" with our office IP and the client's IP, and a backup IP if possible. We have had very very few actual blacklist alert emails, across our clients, maybe a couple per year? (I've blacklisted my home IP once, trying to log in...) And yes "Automatic Global 3CX IP Blacklist" is checked.